Extended Static Checking for Java Cormac Flanagan Joint work with: Rustan Leino, Mark Lillibridge, Greg Nelson, Jim Saxe, and Raymie Stata Compaq Systems Research Center

What is “Static Checking”? Annotated Source Code StaticChecker Error:... type systems type systems Error: wrong number of arguments in method call lint lint Error: unreachable code full program verification full program verification Error: qsort does not yield a sorted array

Why not just use testing?  Testing essential but Expensive Expensive Finds errors late Finds errors late Misses errors Misses errors  Static checking and testing complementary

Comparison of Static Checkers Quality 100% Effort fullverification lint typesystems ExtendedStaticChecking Note: Graph is not to scale ESCModula-3 ESCJava

Goals of ESC/Java  Practical static checking  Detect common run-time errors null dereferences null dereferences array bounds array bounds type casts type casts race conditions race conditions deadlocks deadlocks  Modular checking

Non-goals of ESC/Java  Complete functional verification  Completeness May not pass all programs May not pass all programs  Soundness May fail to detect errors May fail to detect errors Error-resistant, not error-proof Error-resistant, not error-proof

Architecture of ESC/Java Method + annotations Verification condition generator Automatic theorem prover Counterexample  x.  y.(x > y ==> … ) Error: index out of bounds on line 218 Background axioms

Input to ESC/Java Method + annotations Verification condition generator Automatic theorem prover Counterexample Background axioms

Modular checking Method body Client Interface check check Client check

Describing interfaces public class Vector { Object[] a; Object[] a; int size; int size; public Object elementAt(int i) public Object elementAt(int i) {... } {... } public Object[] copyToArray() public Object[] copyToArray() {... } {... }} invariant a != null invariant a != null invariant size <= a.length invariant size <= a.length requires 0 <= i && i < size requires 0 <= i && i < size ensures RES != null && RES.length == size ensures RES != null && RES.length == size modifies size, a[0], a[*] modifies size, a[0], a[*]

Input to ESC/Java’s “checking engine”  Method implementation  Interface annotations requires requires ensures ensures modifies modifies invariants invariants

Verification condition generation Method + annotations Verification condition generator Automatic theorem prover Counterexample Background axioms

Verification condition generation  Easy for small languages [Dijkstra]  Much harder for real languages  Object-oriented  Typed  Dynamic allocation  Exceptions  Aliasing  Threads

Verification conditions for real programs Java Guarded command Verification condition x = a[ i++ ]; i0 = i; i = i + 1; assert (LABEL a != null); assert (LABEL 0 <= i0); assert (LABEL i0 < a.length); x = elems[a][i0];  i0.(i0 == i ==> … ) wlp assume preconditions assume invariants assert postconditions assert invariants

Exceptions  Java has exceptions  Add exceptions ( raise and catch ) to guarded command language  Calculate wlp of GC statement with respect to normal and exceptional postconditions

Method overriding  Method in subclass can override method in superclass Must respect interface of overridden method Must respect interface of overridden method Weaker requires clause Weaker requires clause Stronger ensures clause Stronger ensures clause

Verification condition Method + annotations Verification condition generator Automatic theorem prover Counterexample Background axioms

Verification condition  Formula in untyped, first-order predicate calculus equality and function symbols equality and function symbols quantifiers quantifiers arithmetic operations arithmetic operations select and store operations select and store operations Eg.  x.  y.(x > y ==> … ) Eg.  x.  y.(x > y ==> … )

Example verification condition  Verification condition large but “dumb” (IMPLIES (DISTINCT |ecReturn| |L_14.4|) (IMPLIES (AND (EQ |a:2.8|) (EQ |a:2.8| (asField |a:2.8| (array |T_int|))) ( | |T_Bag|)) (EQ (isAllocated |this | alloc)) (NEQ |this | null)) (FORALL (tmp1 |tmp2:21.4| |tmp3:21.6| |m:12.8| |mindex:13.8| |i:14.13| |tmp0:14.28|) (AND (IMPLIES ( |)) (AND (LBLNEG (NEQ (select |a:2.8| |this |) null)) (LBLNEG ( |)))) (IMPLIES ( |)) 1) |MAX_VALUE:3.4.26|) (AND (LBLNEG (NEQ (select |a:2.8| |this |) null)) (LBLNEG ( |)))) (FORALL (|m:17.8|) (IMPLIES (EQ |m:17.8| (select (select elems (select |a:2.8| |this |)) 1)) (FORALL (|i:14.28|) (IMPLIES (AND (EQ |i:14.28| (+ 1 1)) (EQ |bool$false|)) (FORALL (|tmp2:21.4 |) (IMPLIES (EQ |tmp2:21.4 | (select |a:2.8| |this |)) (AND (LBLNEG (NEQ (select |a:2.8| |this |) null)) (LBLNEG ( | (- (select |n:3.6| |this |) 1)) |this |))) (LBLNEG ( | (- (select |n:3.6| |this |) 1)) |this |) (arrayLength (select |a:2.8| |this |)))) (LBLNEG (NEQ |tmp2:21.4 | null)) (LBLNEG ( |))) (LBLNEG (EQ |ecReturn| |ecReturn|))))))))))) (IMPLIES (NOT ( |)) 1) |MAX_VALUE:3.4.26|)) (FORALL (|i:14.28|) (IMPLIES (AND (EQ |i:14.28| (+ 1 1)) (EQ |bool$false|)) (FORALL (|tmp2:21.4 |) (IMPLIES (EQ |tmp2:21.4 | (select |a:2.8| |this |)) (AND (LBLNEG (NEQ (select |a:2.8| |this |) null)) (LBLNEG ( | (- (select |n:3.6| |this |) 1)) |this |))) (LBLNEG ( | (- (select |n:3.6| |this |) 1)) |this |) (arrayLength (select |a:2.8| |this |)))) (LBLNEG (NEQ |tmp2:21.4 | null)) (LBLNEG ( |))) (LBLNEG (EQ |ecReturn| |ecReturn|)))))))))) (IMPLIES (NOT ( |))) (AND (IMPLIES (EQ |L_14.4| |L_14.4|) (FORALL (|tmp2:21.4 |) (IMPLIES (EQ |tmp2:21.4 | (select |a:2.8| |this |)) (AND (LBLNEG (NEQ (select |a:2.8| |this |) null)) (LBLNEG ( | (- (select |n:3.6| |this |) 1)) |this |))) (LBLNEG ( | (- (select |n:3.6| |this |) 1)) |this |) (arrayLength (select |a:2.8| |this |)))) (LBLNEG (NEQ |tmp2:21.4 | null)) (LBLNEG ( |))) (LBLNEG (EQ |ecReturn| |ecReturn|)))))) (IMPLIES (NOT (EQ |L_14.4| |L_14.4|)) (AND (LBLNEG (EQ |L_14.4| |ecReturn|))))))))))

Background axioms Method + annotations Verification condition generator Automatic theorem prover Counterexample Background axioms

 Additional properties of Java that the theorem prover needs to know  A variable of type T always holds a value whose type is a subtype of T  The subtyping relation is reflexive, anti-symmetric, and transitive  new returns an object that is distinct from all existing objects ... lots more...  java.lang.Object has no supertype

Automatic theorem proving Method + annotations Verification condition generator Automatic theorem prover Counterexample Background axioms

Automatic theorem proving  Use Simplify Theorem prover from ESC/Modula-3 Theorem prover from ESC/Modula-3 Accepts formulae in untyped, first-order predicate calculus Accepts formulae in untyped, first-order predicate calculus Attempts to prove or refute Attempts to prove or refute

Automatic theorem proving Verification condition Automatic theorem prover (Simplify) Counterexample  x.  y.(x > y ==> … ) DivergesValid

Handling counterexamples Method + annotations Verification condition generator Automatic theorem prover Counterexample Background axioms

Error message from counterexample Verification condition Automatic theorem prover (Simplify) Counterexample:  x.  y. ( … ( … (LABEL …) …) (LABEL …) …) x417 > 7 … Label: … Error: index out of bounds on line 218

Initial experience  First implementation is done  Run on 30,000+ lines of code (mostly itself)  Caught several errors null dereference, array bounds null dereference, array bounds  Programmer can annotate and check about 300 lines per hour  Looks promising...

Demonstration

ESC/Java Summary  Finds more errors than type checking  Costs less than full verification  Currently working; is being evaluated  Potential as “software reliability metric”  Practical checking based on automatic theorem proving may be possible

Comparison of Static Checkers Quality 100% Effort fullverification lint typesystems decidabilitylimit ExtendedStaticChecking Note: Graph is not to scale

Metrics for Static Checkers  Cost of using the tool  Quality Does it miss errors? Does it give spurious warnings?

Challenges  Automatic theorem proving  Error messages from counterexample  Verification conditions for real programs  Object-oriented  Typed  Dynamic allocation  Exceptions

ESC/Java vs. Testing  Testing essential but Expensive Expensive Finds errors late Finds errors late Misses errors Misses errors  ESC/Java... ?

Background axioms Java Guarded command Verification condition Background axioms wlp

Additional annotations assert assume nowarn axiom

Describing interfaces public Integer[] sum(Integer[] a, Integer[] b); requires a != null && b != null; requires a.length == b.length; ensures RES != null && RES.length == a.length; modifies a[0], b[*];